Full Report
Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders. The post Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools appeared first on Unit 42.
Analysis Summary
Based on the Unit 42 research regarding Active Directory Certificate Services (AD CS) exploitation, here is the technical summary focusing on the escalated misuse techniques and associated tools.
# Tool/Technique: AD CS Certificate Template Misconfiguration & Shadow Credentials
## Overview
This research focuses on the exploitation of Active Directory Certificate Services (AD CS), specifically targeting misconfigured certificate templates (ESC1, ESC2, ESC3) and the "Shadow Credentials" technique. These methods allow attackers with low-privileged access to escalate privileges to Domain Admin or impersonate any user/machine within an Active Directory environment by leveraging legitimate PKI (Public Key Infrastructure) functions.
## Technical Details
- **Type:** Technique / Exploitation Frameworks
- **Platform:** Windows / Active Directory
- **Capabilities:** Credential theft, privilege escalation, persistence, and domain dominance.
- **First Seen:** Techniques gained widespread recognition circa 2021 (SpecterOps "Certified Pre-Owned" research).
## MITRE ATT&CK Mapping
- **[TA0004 - Privilege Escalation]**
- [T1649 - Steal or Forge Authentication Certificates]
- **[TA0006 - Credential Access]**
- [T1556.004 - Modify Authentication Process: MS-PKCA]
- **[TA0003 - Persistence]**
- [T1098 - Account Manipulation]
## Functionality
### Core Capabilities
- **Template Exploitation (ESC1/ESC2/ESC3):** Leveraging templates where `ENROLLEE_SUPPLIES_SUBJECT` is enabled, allowing an attacker to request a certificate for a Domain Administrator using their own low-privileged session.
- **Shadow Credentials:** Using the `msDS-KeyCredentialLink` attribute to add a new public key to a target object (User or Computer), subsequently using the corresponding private key to authenticate as that object via PKI.
### Advanced Features
- **NTLM Relay to AD CS:** Intercepting authentication and relaying it to the Web Enrollment endpoints to automatically provision rogue certificates.
- **Certificate Persistence:** Generating long-lived certificates that remain valid even if a user changes their password.
## Indicators of Compromise
- **File Names:** `Certify.exe`, `Certipy`, `ForgeCert.exe`, `Seatbelt.exe`.
- **Behavioral Indicators:**
- Enrollment requests for templates with high privileges (e.g., DomainAdmin, EnterpriseAdmin).
- Anomalous `msDS-KeyCredentialLink` attribute modifications (Event ID 5136).
- Unexpected certificate signings by a Subordinate CA or non-standard templates.
- Large volumes of `4624` (Logon) events with `Authentication Package: Kerberos` and `Logon Process: Schannel`.
## Associated Threat Actors
- **APT29 / Cozy Bear** (Known for advanced credential shuffling and certificate misuse).
- **Red Team/Penetration Testers** (Widespread use of specialized tooling).
## Detection Methods
- **Signature-based detection:**
- Detection of known tool strings (e.g., "Certify" or "Certipy") in command line logs.
- **Behavioral detection:**
- Monitoring for **Event ID 4887** (Certificate Services approved a certificate request) where the requester differs significantly from the Subject Name.
- Monitoring for **Event ID 4886** (Certificate Services received a certificate request) containing suspicious template names.
- Tracking RPC calls to `ICertPassage` and `ICertRequest` interfaces from non-standard administrative hosts.
- **YARA/Sigma:** Use Sigma rules to detect `msDS-KeyCredentialLink` modifications via `dsacls` or `Set-ADUser`.
## Mitigation Strategies
- **Prevention measures:**
- Disable the `ENROLLEE_SUPPLIES_SUBJECT` flag on all certificate templates unless strictly necessary.
- Remove "Authenticated Users" from the enrollment permissions of sensitive templates.
- Disable HTTP Web Enrollment endpoints if not required.
- **Hardening recommendations:**
- Implement **Restricted Admin** mode for RDP.
- Enable **Certificate Transparency** and auditing for CA operations.
- Use the "Protected Users" security group for high-privileged accounts.
## Related Tools/Techniques
- **Certify:** A C# tool to find and exploit vulnerable certificate templates.
- **Certipy:** A Python-based tool for AD CS enumeration and exploitation (often used from Linux/Kali).
- **Rubeus:** Used for Kerberos interaction following certificate-based authentication.
- **Adidnsdump:** Often used in conjunction to map AD environments for relay targets.